Since Chromium 148, Math.tanh Reveals the Underlying OS
A new signal in browser fingerprinting: Math.tanh
1Math.tanh and OS Relationship
Since Chromium 148, the Math.tanh function has become usable in browser fingerprinting due to OS-specific bit differences. This results in different outputs on Linux, macOS, and Windows.
2Source of Bit Differences
The results of the Math.tanh function depend on the OS's math library. Linux uses glibc, macOS uses libsystem_m, and Windows uses UCRT. These libraries create differences in the last bits of the results.
3Examples of Differences
The call Math.tanh(0.8) yields 0.6640367702678491 on Linux, 0.664036770267849 on macOS, and 0.6640367702678489 on Windows. These minor differences can be used to detect the OS.
4Pre-Chromium 148 Situation
Before Chromium 148, V8 computed Math.tanh internally, producing the same result across all OSes. This made OS detection impossible.
5V8's Changing Behavior
Starting with Chromium 148, V8 began computing Math.tanh using the platform's std::tanh function. This change revealed OS-specific bit differences.
6CSS vs JavaScript Difference
CSS trigonometric functions and JavaScript Math functions follow different code paths. CSS functions can produce different results by using the OS's math library.
7Two Math Libraries in macOS
On macOS, scalar libsystem_m and Accelerate framework's vector routines produce different results. This makes choosing the correct library challenging.
8Architectural Differences
ARM and x86 architectures behave differently regarding fused-multiply-add and NaN sign propagation. These differences can cause bit-level deviations in mathematical calculations.
9Security Vulnerability
Math.tanh revealing the OS creates a new security vulnerability in browser fingerprinting. This poses a risk to user privacy.
10Browser Matching Difficulty
Services like Scrapfly struggle to mimic Math.tanh's bit differences. This makes it harder to emulate real browsers.
11IEEE 754 and Mathematical Calculations
The IEEE 754 standard defines how double-precision numbers are stored but does not require functions like sin, cos, and tanh to be correctly rounded. This leads to different math libraries producing different results.
12Conclusion and Importance
Math.tanh revealing the OS provides a new tool in browser fingerprinting. This issue becomes significant for user privacy and security.